Stéphane Tailland
9376bc3cb3
cert-manager-issued Certificates never synced to Konnect as KongCertificate objects through the Gateway API listener path, so dataplanes fell back to Kong's default self-signed cert. Reuse the working kong-namespace pattern (a static wildcard cert) via ExternalSecret instead.
24 lines
1.1 KiB
YAML
24 lines
1.1 KiB
YAML
# Cluster-wide defaults for the dataplane-template ${VAR}s. NOT part of
|
|
# dataplane-template/ itself (that folder is what gets built+applied once
|
|
# per domain into its own namespace — this ConfigMap is applied once,
|
|
# cluster-wide, in flux-system). Each domain's Kustomization lists this
|
|
# FIRST in postBuild.substituteFrom, then its own ConfigMap/Secret after —
|
|
# Flux applies "last wins" precedence across substituteFrom entries, so a
|
|
# domain can still override any of these if it ever needs to.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: dataplane-template-defaults
|
|
namespace: flux-system
|
|
data:
|
|
KONNECT_SERVER_URL: eu.api.konghq.com
|
|
GATEWAY_IMAGE: kong/kong-gateway:3.15
|
|
REPLICAS: "1"
|
|
OIDC_ISSUER: https://keycloak.sttlab.eu/realms/sttlab # Keycloak today, but this template shouldn't assume it stays that way
|
|
CORS_ORIGINS: https://*.sttlab.local
|
|
RATE_LIMIT_MINUTE: "300"
|
|
REQUEST_MAX_BODY_SIZE: "10" # MB
|
|
# Jaeger v2 (OTLP-native), Helm-installed 2026-08-20, ns observability,
|
|
# cluster-wide — shared by every domain, not domain-specific.
|
|
OTEL_TRACES_ENDPOINT: http://jaeger.observability.svc.cluster.local:4318/v1/traces
|